CVE-2019-15681
CVE-2019-15681
This page contains facts from public vulnerability sources. Check the original advisory before updating.
This page shows selected source facts. See the linked advisories for the complete description and affected versions.
LibVNC commit before d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a contains a memory leak (CWE-655) in VNC server code, which allow an attacker to read stack memory and can be abused for information disclosure. Combined with another vulnerability, it can be used to leak stack memory and bypass ASLR. This attack appear to be exploitable via network connectivity. These vulnerabilities have been fixed in commit d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a.
CVSS 7.5 · High · EPSS 2.9% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
libvnc
- Versions
- 0.9.12: Affected
No fix published
libvncserver Debian:12
- Affected ranges
- ECOSYSTEM: < 0.9.12+dfsg-3
Update to 0.9.12+dfsg-3
libvncserver Debian:13
- Affected ranges
- ECOSYSTEM: < 0.9.12+dfsg-3
Update to 0.9.12+dfsg-3
libvncserver Debian:14
- Affected ranges
- ECOSYSTEM: < 0.9.12+dfsg-3
Update to 0.9.12+dfsg-3
tightvnc Debian:12
- Affected ranges
- ECOSYSTEM: < 1:1.3.9-9.1
Update to 1:1.3.9-9.1
tightvnc Debian:13
- Affected ranges
- ECOSYSTEM: < 1:1.3.9-9.1
Update to 1:1.3.9-9.1
tightvnc Debian:14
- Affected ranges
- ECOSYSTEM: < 1:1.3.9-9.1
Update to 1:1.3.9-9.1
vino Debian:12
- Affected ranges
- ECOSYSTEM: < 3.22.0-6
Update to 3.22.0-6
tightvnc Ubuntu:Pro:14.04:LTS
- Versions
- 1.3.9-6.4
- 1.3.9-6.4ubuntu1
- Affected ranges
- ECOSYSTEM: < 1.3.9-6.5+deb8u1build0.14.04.1~esm1
Update to 1.3.9-6.5+deb8u1build0.14.04.1~esm1
x11vnc Ubuntu:14.04:LTS
- Versions
- 0.9.13-1.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
italc Ubuntu:16.04:LTS
- Versions
- 1:2.0.2+dfsg1-3
- 1:2.0.2+dfsg1-4
- Affected ranges
- ECOSYSTEM: < 1:2.0.2+dfsg1-4ubuntu0.1
Update to 1:2.0.2+dfsg1-4ubuntu0.1
libvncserver Ubuntu:16.04:LTS
- Versions
- 0.9.10+dfsg-3
- 0.9.10+dfsg-3build1
- 0.9.10+dfsg-3ubuntu0.16.04.1
- 0.9.10+dfsg-3ubuntu0.16.04.2
- 0.9.10+dfsg-3ubuntu0.16.04.3
- Affected ranges
- ECOSYSTEM: < 0.9.10+dfsg-3ubuntu0.16.04.4
Update to 0.9.10+dfsg-3ubuntu0.16.04.4
vino Ubuntu:16.04:LTS
- Versions
- 3.8.1-0ubuntu6
- 3.8.1-0ubuntu7
- 3.8.1-0ubuntu8
- 3.8.1-0ubuntu9
- 3.8.1-0ubuntu9.1
- 3.8.1-0ubuntu9.2
- Affected ranges
- ECOSYSTEM: < 3.8.1-0ubuntu9.3
Update to 3.8.1-0ubuntu9.3
krfb Ubuntu:16.04:LTS
- Versions
- 4:15.08.2-0ubuntu1
- 4:15.12.1-1ubuntu1
- 4:15.12.3-0ubuntu1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tightvnc Ubuntu:16.04:LTS
- Versions
- 1.3.10-0ubuntu2
- 1.3.10-0ubuntu3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
italc Ubuntu:18.04:LTS
- Versions
- 1:3.0.3+dfsg1-1
- 1:3.0.3+dfsg1-2
- 1:3.0.3+dfsg1-2build1
- 1:3.0.3+dfsg1-2ubuntu1
- 1:3.0.3+dfsg1-3
- Affected ranges
- ECOSYSTEM: < 1:3.0.3+dfsg1-3ubuntu0.1
Update to 1:3.0.3+dfsg1-3ubuntu0.1
libvncserver Ubuntu:18.04:LTS
- Versions
- 0.9.11+dfsg-1
- 0.9.11+dfsg-1ubuntu1
- 0.9.11+dfsg-1ubuntu1.1
- Affected ranges
- ECOSYSTEM: < 0.9.11+dfsg-1ubuntu1.2
Update to 0.9.11+dfsg-1ubuntu1.2
vino Ubuntu:18.04:LTS
- Versions
- 3.8.1-0ubuntu12
- 3.22.0-2ubuntu1
- 3.22.0-3ubuntu1
- Affected ranges
- ECOSYSTEM: < 3.22.0-3ubuntu1.1
Update to 3.22.0-3ubuntu1.1
krfb Ubuntu:18.04:LTS
- Versions
- 4:17.04.3-0ubuntu1
- 4:17.08.3-0ubuntu1
- 4:17.12.2-0ubuntu1
- 4:17.12.3-0ubuntu1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tightvnc Ubuntu:18.04:LTS
- Versions
- 1.3.10-0ubuntu3
- 1.3.10-0ubuntu4
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
vino Ubuntu:20.04:LTS
- Versions
- 3.22.0-5ubuntu2
- Affected ranges
- ECOSYSTEM: < 3.22.0-5ubuntu2.1
Update to 3.22.0-5ubuntu2.1
krfb Ubuntu:20.04:LTS
- Versions
- 4:19.04.3-0ubuntu2
- 4:19.08.3-0ubuntu1
- 4:19.08.3-0ubuntu2
- 4:19.12.0-0ubuntu1
- 4:19.12.1-0ubuntu1
- 4:19.12.2-0ubuntu1
- 4:19.12.2-1
- 4:19.12.3-0ubuntu1
- 4:19.12.3-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tightvnc Ubuntu:20.04:LTS
- Versions
- 1.3.10-0ubuntu5
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
veyon Ubuntu:20.04:LTS
- Versions
- 4.2.4+repack1-2
- 4.2.5+repack1-1
- 4.3.1+repack1-1
- 4.3.1+repack1-2
- 4.3.1+repack1-2build1
- 4.3.1+repack1-2build2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
Original sources
- https://github.com/LibVNC/libvncserver/commit/d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a
- https://lists.debian.org/debian-lts-announce/2019/10/msg00039.html
- https://lists.debian.org/debian-lts-announce/2019/10/msg00042.html
- https://lists.debian.org/debian-lts-announce/2019/11/msg00032.html
- https://lists.debian.org/debian-lts-announce/2019/12/msg00028.html
- http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00027.html
- https://usn.ubuntu.com/4407-1/
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00073.html
- https://usn.ubuntu.com/4547-1/
- https://usn.ubuntu.com/4573-1/
- https://usn.ubuntu.com/4587-1/
- https://cert-portal.siemens.com/productcert/pdf/ssa-390195.pdf
- https://nvd.nist.gov/vuln/detail/CVE-2019-15681